The vulnerability in Skyline DataMiner BrokerGateway allows an unauthenticated attacker to retrieve the device‑specific embedded API key even when pairing mode is disabled. Using this key, the attacker can obtain the DataMinerUser.creds NATS credential and gain trusted access to the message bus on TCP port 4222 without any prior DataMiner credentials. This results in complete control over the message bus and the ability to read, modify, or inject messages across the network. The weakness corresponds to improper authentication and insecure credential storage.

Skyline Communications DataMiner software versions prior to 10.6.9 CU1, 10.6.0 CU7, 10.5.0 CU19, and 10.4.0 CU22 are affected. These versions are deployed in environments that use BrokerGateway for broker‑to‑Broker communication and rely on the embedded API key for secure pairing.

The CVSS score of 8.7 indicates high severity, and the EPSS score is not available, so the exploitation likelihood is uncertain. The vulnerability is not listed in CISA KEV, and no public exploit has been documented. It can be exploited remotely over a network connection to the BrokerGateway API, as the compromised key can be retrieved without authentication from any reachable endpoint. The absence of pairing mode does not mitigate the risk because the embedded key remains accessible.